comparison mercurial/sslutil.py @ 29578:4a4b8d3b4e43

sslutil: move comment about protocol constants

protocolsettings() is the appropriate place for this comment.

29577:9654ef41f7cc

        'ctxoptions': None,
        # OpenSSL Cipher List to use (instead of default).
        'ciphers': None,
    }

    # Despite its name, PROTOCOL_SSLv23 selects the highest protocol
    # that both ends support, including TLS protocols. On legacy stacks,
    # the highest it likely goes is TLS 1.0. On modern stacks, it can
    # support TLS 1.2.
    #
    # The PROTOCOL_TLSv* constants select a specific TLS version
    # only (as opposed to multiple versions). So the method for
    # supporting multiple TLS versions is to use PROTOCOL_SSLv23 and
    # disable protocols via SSLContext.options and OP_NO_* constants.
    # However, SSLContext.options doesn't work unless we have the
    # full/real SSLContext available to us.

    # Allow minimum TLS protocol to be specified in the config.
    def validateprotocol(protocol, key):
        if protocol not in configprotocols:
            raise error.Abort(
                _('unsupported protocol from hostsecurity.%s: %s') %

def protocolsettings(protocol):
    """Resolve the protocol and context options for a config value."""
    if protocol not in configprotocols:
        raise ValueError('protocol value not supported: %s' % protocol)

    # Legacy ssl module only supports up to TLS 1.0. Ideally we'd use
    # PROTOCOL_SSLv23 and options to disable SSLv2 and SSLv3. However,
    # SSLContext.options doesn't work in our implementation since we use
    # a fake SSLContext on these Python versions.
    if not modernssl:
        if protocol != 'tls1.0':
            raise error.Abort(_('current Python does not support protocol '
                                'setting %s') % protocol,
                              hint=_('upgrade Python or disable setting since '

29578:4a4b8d3b4e43

        'ctxoptions': None,
        # OpenSSL Cipher List to use (instead of default).
        'ciphers': None,
    }

    # Allow minimum TLS protocol to be specified in the config.
    def validateprotocol(protocol, key):
        if protocol not in configprotocols:
            raise error.Abort(
                _('unsupported protocol from hostsecurity.%s: %s') %

def protocolsettings(protocol):
    """Resolve the protocol and context options for a config value."""
    if protocol not in configprotocols:
        raise ValueError('protocol value not supported: %s' % protocol)

    # Despite its name, PROTOCOL_SSLv23 selects the highest protocol
    # that both ends support, including TLS protocols. On legacy stacks,
    # the highest it likely goes is TLS 1.0. On modern stacks, it can
    # support TLS 1.2.
    #
    # The PROTOCOL_TLSv* constants select a specific TLS version
    # only (as opposed to multiple versions). So the method for
    # supporting multiple TLS versions is to use PROTOCOL_SSLv23 and
    # disable protocols via SSLContext.options and OP_NO_* constants.
    # However, SSLContext.options doesn't work unless we have the
    # full/real SSLContext available to us.
    if not modernssl:
        if protocol != 'tls1.0':
            raise error.Abort(_('current Python does not support protocol '
                                'setting %s') % protocol,
                              hint=_('upgrade Python or disable setting since '